Panther

Overview

Material can send issue lifecycle events to Panther via webhook. Panther receives those events through an HTTP source, normalizes fields, and makes the data available for detections, search, and alert routing.

Event Flow

Material Issue Change event ( type=CREATE|UPDATE ) > Material Event Subscription (Webhook) > Panther HTTP Log Source (Bearer auth) > Panther schema normalization > Detections / Search / Alerts.

How to configure the Panther Integration

Step One: In Your Panther Console

The instructions below are from Panther's documentation. Always confirm accuracy with Panther.

1. In the left-hand navigation bar of your Panther Console, click Configure, then Log Sources.
2. Click Create New.
3. Search for “Material Security,” then click its tile.
4. In the slide-out panel, click Start Setup.
5. Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.

   • In the Auth method dropdown field, select Bearer.
   • Payloads sent to this source are subject to the payload requirements for all HTTP sources.
   • Do not proceed to the next step until your HTTP endpoint creation has completed.
   • You will include this bearer token in Step Two below.

Step Two: Configure Material Panther Integration

1. In Material, click Integrations (in the top tool bar).
2. Scroll to SIEM, then click Panther:

   
3. Complete the required fields:

   1. Method: Set to POST
   2. URI: Your Panther HTTP source
   3. Headers: Include { "Authorization": "Bearer <token-value>" } (the bearer token you created in Panther, see Step One or Panther's docs here).
4. Events: Two useful events are pre-configured by default: Issue Change and Audit Log Updated. By default, the webhook triggers any issue change occurs or the audit log updates.

   1. Optionally, Click the Issue Change event row to edit. Consider filtering Issue Change further by statuses , severities , detections depending on your needs.
   2. Also consider checking the box to enable Include events for messages being added / removed / interacted with in a phishing case only for higher volume and more sensitive payloads.

      

      Example Issue Change Filtering

Learn more about events here.

Payload

Representative structure for the Issue Change subscription payload:

{
"eventId": "evt_...",
"timestamp": "2026-03-11T15:10:00Z",
"type": "CREATE",
"tenant": { "uDomainId": "..." },
"account": { "uAcctId": "...", "email": "..." },
"issue": { "id": "...", "status": "...", "severity": "...", "detectionId": "..." },
"before": null,
"after": { "status": "open" },
"messageChange": null
}

---

Operational Guidance

• Start least-privilege: Start with minimal stream filters. Broaden the scope only as required by your Security Operations Center (SOC) needs.
• Test with sample events: Validate how the system handles create and update actions before a full production rollout. Learn more about testing here.
• Document ownership: Designate specific owners:

  • Subscription configuration: Responsible for webhook and event settings
  • Panther parser and detections: Responsible for managing the Panther parser
• Track drift: If you customize event templates, use version control and review them quarterly to ensure they remain aligned with your requirements.

---

Resources & Troubleshooting

Review SIEM Integrations for more detail about events and troubleshooting.